The City of Nanaimo is dealing with a breach of confidential information.
According to a city-issued press release Friday, the entire a copy of a KPMG final report was leaked on social media. The press release goes on to state that the report was confidential and in camera and that it contains third-party information, as well as personal information of individuals.
The city is apparently ensuring that “steps are being taken to recover the sensitive information” and that the breach has been reported to all appropriate authorities including the Office of the Information and Privacy Commissioner.
Megan Waggoner, the records supervisor with the city, told the News Bulletin in an e-mail that as of May 2 there were 175 active city-issued purchase cards and that there were 187 active city-issued purchase cards in 2017.
RELATED: Nanaimo’s CFO used city purchase card for 11 personal flights
RELATED: City manager wants stricter limits on employee expenses
The report was released online by Robert Fuller, the brother of Coun. Gord Fuller. The KPMG report, which was obtained separately by the News Bulletin, is a detailed forensic audit that deals with purchase card use by Nanaimo city employees specifically between January 2010 until October 2017 because there were “insufficient records” prior to 2010.
Although the city does have a policy that prohibits employees from using purchase cards for personal use, according to KPMG report, the city does “condone” purchases for personal expenses in certain circumstances, as long as the individual repaid the personal expense in a “timely” fashion.
Business expenses that contained a personal component such as paying for a spouse to attend a conference, and using a purchase card in “apparent” error were there were two main reasons why personal expenses were made using city-issued purchase cards, according to KPMG’s report, which also stated that staff generally reimbursed the city.
However, the report noted, there were two individuals who were an exception to the “general” rule. One individual, identified as “Person A” used a purchase card extensively for pay for personal expenses and “sometimes” didn’t bother to repay the city for extended periods of time, while the second individual identified as “Person B” made multiple personal expenses, then while repaying the city, incurred even more personal expenses with their purchase card. The report indicates that the money was eventually paid back by Person B through regular $500 deductions on their paycheque.
The report also makes a number of recommendations, such as that the city ban the use purchase cards for personal use and that the city record all personal uses with a purchase card and their repayments. KPMG also noted that it was “apparent” to them that city staff have a limited understand of what they should approve when they sign off on a “subordinate’s” purchase card use.
Fuller told the News Bulletin that he released the information because the government has the “duty” to release information in a timely manner, that the city is leaking information “like a sieve” and that he felt the public needed to see the report.
“My own personal thought was that the public does deserve to have the information in front of them, especially after KPMG did their audit and presentation in front of council at the finance and audit committee. Why this wasn’t included in it is beyond me,” Fuller said.
It was a surprise to Fuller than the city issued a press release regarding his exposure of the KPMG report. He said the city has since sent him letter basically asks him whether he believed the information he released was “in the city’s care and control” when he released it. He said he didn’t believe KPMG report was in the care and control of the city, adding that since his release another individual has gone on to name the people mentioned in the report.
“Where do you get the names from? It’s obviously come from in camera or something like that,” he said.